question regarding serial number in SP metadata

[Cantor, Scott]

On 4/24/13 6:19 PM, "Christine Ross" <cross at hccs.com> wrote:

>I am trying to set up my v2.4.3 SP (Solaris Sparc) with and ADSF Saml2
>IDP.  The authentication is failing apparently because the IDP wants a
>serial number and it appears the serial number is 0 for my IDP (at least
>that is what it reads
> when I read the x509Certificate taken from
>https://site/Shibboleth.sso/Metadata.

I can say with 99% certainty that's not why it's failing. I have never
heard of any such issue with ADFS, and I doubt it knows how to use that
KeyInfo feature for anything.

> 
>If the serial number is not in the certificate, how can I get the
>X509SerialNumber field populated in the metadata?

The serial number of a certificate is by definition in the certificate and
if you want it in the metadata, you can put it there. That's not likely to
fix anything.

If the problem is that ADFS can't handle a certificate with a serial
number of 0, putting the serial number into the metadata doesn't change
what it is.

>I looked at the keygen.pl but do not see an option for serial number when
>generating a certificate and I don¹t see the option in the metadata.

The only keygen tool in the SP isn't a Perl script, but there is no such
option in it. A self-signed certificate, while not a CA, tends to have a
serial number of 0, like a CA.

-- Scott